Lead magnet
See what a readiness assessment actually produces
A full sample report, built on a fictional estate. The structure, the level of detail and the way findings are qualified are exactly what a real engagement produces. Everything below this line is a genuine excerpt from it.
Contents
What is in the report
| Section | Pages | What it contains |
|---|---|---|
| 1. Executive summary | 2 | Findings, decisions required, and what they cost |
| 2. Estate inventory | 6–14 | Every gateway and tunnel, with confidence per field |
| 3. Compatibility analysis | 5–10 | Capability per platform, release and licence combination |
| 4. Blocker register | 3–6 | Each blocker with owner, options and review date |
| 5. Complexity profile | 2 | Technical and operational dimensions, with drivers |
| 6. Migration wave plan | 4–8 | Waves ordered by risk and dependency |
| 7. Engineering runbooks | 8–20 | Per-platform procedures, written to be executed |
| 8. Verification plan | 3 | What evidence proves each change, and from where |
| 9. Migration proposal | 3 | Fixed-scope option if you want PQVPN to deliver |
Excerpt · Section 2
Estate inventory
Note the confidence column. A field read from a device and a field taken from a backup archive are not the same evidence, and a plan built on the second needs to say so.
| Asset | Platform | Tunnels | Confidence |
|---|---|---|---|
| GW-014 | Firewall platform A | 17 | Confirmed |
| GW-021 | Router platform B | 6 | Confirmed |
| GW-033 | Legacy appliance C | 3 | Unconfirmed |
| CVG-02 | Managed cloud VPN | 8 | Confirmed |
Excerpt · Section 4
Blocker register
Every blocker names a specific reason, a set of options and an owner. “Not supported” never appears on its own — it is not actionable, and it is not a finding.
Branch network — HQ
Blocked- Reason
- Appliance past end of software maintenance; no supporting release exists for this model
- Options
- Hardware refresh, overlay gateway, defer
- Owner
- Network infrastructure
- Review date
- Set per engagement
Clearing partner — DMZ
Peer-dependent- Reason
- Counterparty has not confirmed capability after two requests
- Options
- Contractual escalation, overlay gateway, documented exception
- Owner
- Vendor management
- Review date
- Set per engagement
Legacy supplier link
Blocked- Reason
- Still IKEv1; no post-quantum mechanism exists for IKEv1
- Options
- Migrate to IKEv2 first as a separate change, then reassess
- Owner
- Network engineering
- Review date
- Set per engagement
Excerpt · Section 5
Complexity profile
- Band
- Substantial
- Top technical drivers
- Gateway platform count, vendor diversity, legacy devices
- Top operational drivers
- External counterparties, change-control regime
- Implication
- Structured assessment with per-platform research, peer coordination, and a multi-wave plan with explicit blockers.
Excerpt · Section 6
Migration wave plan
- Wave 0
- 2 canary tunnels, dominant platform, low criticality
- Wave 1
- 31 tunnels, dominant platform, internally controlled peers
- Wave 2
- 14 tunnels, remaining internal platforms, HA members split
- Wave 3
- 9 tunnels, cloud VPN gateways, sequenced after peer migration
- Wave 4+
- 11 tunnels, partner-dependent, scheduled by counterparty
- Deferred
- 7 tunnels, replacement or blocked, each with an owner
Excerpt · Section 1
Executive summary
“Of 74 tunnels assessed, 45 can migrate to hybrid post-quantum key establishment using releases already deployed or a scheduled software upgrade. A further 11 depend on external counterparties and are scheduled into later waves; coordination has begun and two counterparties have confirmed capability. Seven tunnels terminate on devices past end of software maintenance and require a decision between hardware refresh, an overlay gateway, or documented deferral.
Three decisions require approval before Wave 1 can begin: the capital request for four appliance replacements, the acceptance of an overlay design for two partner links, and the change-window allocation for a platform upgrade affecting 31 tunnels.
Post-quantum authentication is out of scope for this programme and remains dependent on the certificate estate. That is a separate piece of work and is recorded as such rather than assumed to follow.”
Fictional estate. Figures are illustrative and do not represent any engagement.
Request the full sample
The complete report, by email
Five fields. You have already seen an excerpt of every section above, so this is not a gate in front of the useful part — it is a request for the whole document.